aws-samples / aws-samples/aws-cloudhsm-jce-examples
More realistic symmetric key export example
- Dominant language
- Java
- Stars
- 46
- Forks
- 70
- Avg merge
- 52m
- Merged PRs (30d)
- 4
Description
A common key exchange operation is that a "client" provides a public (RSA or EC) key to the HSM, the HSM generates a symmetric key encrypted under that public key, and the client then imports the symmetric key into its own keystore. (This is a toy example of how key exchange between HSMs and mobile devices works.) The existing code samples provide hints at how to accomplish each of these steps _except_ importing the public key; [RSAImportKey](https://github.com/aws-samples/aws-cloudhsm-jce-examples/blob/master/src/main/java/com/amazonaws/cloudhsm/examples/RSAImportKey.java) does something similar but in the opposite direction.
An end-to-end example for exporting an AES key using this flow would be welcome.
Contributor guide
Research direction
Start by reviewing the existing code samples and RSAImportKey.java, which demonstrates the related reverse-direction public-key import. Trace how the examples handle public-key import, HSM-generated symmetric keys, and client-side keystore import. Done means an end-to-end example exporting an AES key encrypted under a client RSA or EC public key.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, java
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100